In the Claims : 

Please amend Claims 1 , 2, 1 0, 11 , 1 3, and 26 as indicated below. The status 
of all pending claims is as follows: 

1. (Currently Amended) An vmauthorized access prevention system, 

including: 

a traffic recording unit recording information on traffic that flows into a 
user's communication network; 

a search unit searching , from the information recorded in the traffic 
recording unit, the flowing-in path of unauthorized access, which is transmitted from a 
transmitter and is included in the traffic, to services disclosed from a user's 
communication network; 

a determination imit determining a countermeasure implementation 
plarming place plac e to impl e m e nt a count e rm e a s«fe-for protecting the services from the 
unauthorized access based on a result of the search; and 

a notification unit notifying, according to a d e t e rmination that th e 
coimt e rm e asur e is impl e m e nt e d in a flow sourc e that malc e s th e unauthoriz e d acc e ss flow 
into th e us e r's communication n e twork, th e d e t e rmination of the plac e to impl e m e nt the 
count e rmeasur e to the a_flow source adjacent to the user's communication network of the 
determination of the coimtermeasure implementation plaiming place, when the 
determination unit determines the flow source as the countermeasure implementation 
plarming place for a reason that the unauthorized access was flowed into the user's 
commvmication network . 
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2 . (Currently Amended) A recording medium in which a program that 
directs a computer to implement a countermeasure against unauthorized access is 
recorded and in which the program can be read by the computer, and the program directs 
the computer to perform the following processes by being executed by the computer: 

a detection process of detecting an unauthorized access transmitted from a 
transmitter to services disclosed from a user's communication network; and 

when the detection of the imauthorized access is notified, performs the 
following process: 

a search process of searching the flowing-in path of the unauthorized access 
to the services disclosed from the user's communication network; 

a determination process of determining a coimtermeasure implementation 
plaiming place to impl e m e nt a count e rm e asur e for protecting the services from the 
imauthorized access based on a result of the search; and 

a notification process of notifying , according to a det e rmination that th e 
coimterm e asur e is impl e m e nt e d in a flow sourc e that malc e s th e unauthoriz e d acc e ss flow 
into th e us e r's communication n e twork, th e d e t e rmination of th e plac e to impl e m e nt th e 
counterm e asur e to th e ^ flow source adjacent to the user's communication network of the 
determination of the countermeasure implementation planning place, when the 
determination unit determines the flow source as the countermeasure implementation 
planning place for a reason that the unauthorized access was flowed into the user's 
communication network . 
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3-4. (Cancelled) 



5 . (Original) The recording medium according to claim 2, wherein 
the process of searching the flowing-in path is performed by the computer based on the 
monitoring information on the traffic transmitted by a user's communication network and 
the unauthorized access information indicating the contents of the unauthorized access. 

6. (Original) The recording medium according to claim 5, wherein 
the monitoring information includes at least the position information on an edge router 
arranged on the border between the user's communication network and the 
communication network adjacent to the user's communication network and the 
monitoring information on the traffic that flows into the user's communication network 
via the edge router. 

7. (Previously Presented) The recording medium according to 
claim 2, wherein the notification process makes the computer execute a process of 
notifying the determination to the flow source afiter mutual attestation is conducted with 
the flow source of the unauthorized access. 

8. (Original) The recording medium according to claim 2, wherein 
the process of notifying the determination to the flow source after information on a 
security policy for the operation of each network is exchanged with the flow source that 
transmits the unauthorized access is performed by the computer. 
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9. (Previously Presented) The recording medium according to 
claim 8, wherein information on a security policy is the information indicating the time 
required until the countermeasure against the unauthorized access is cancelled after the 
unauthorized access is not detected any more. 

10. (Currently Amended) The recording medium according to 
claim 9, wherein when the time indicated by the information on the security policy differs 
between the useF^ user's communication network and the flow source, a shorter time of 
the two is used as the time required until the covmtermeasure against unauthorized access 
is cancelled after the unauthorized access is not detected any more. 

11. (Currently Amended) The recording medium according to 
claim 10, wherein the process of notifying the flow source of the determination and the 
information indicating the time required ti Huntil the countermeasure against the 
unauthorized access is cancelled after the unauthorized access is not detected any more is 
performed by the computer. 

12. (Original) The recording medium according to claim 2, wherein 
the process of notifying the flow source of the unauthorized access of the determination 
using the communication path that differs from the flowing-in path of the unauthorized 
access is performed by the computer. 
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13. (Currently Amended) A recording medium in which a program 
that directs a computer to implement a coimtermeasure against unauthorized access is 
recorded and in which the program can be read by the computer, and the program directs 
the computer to perform the following processes by being executed by the computer: 

a detection process of detecting an unauthorized access transmitted from a 
transmitter to services disclosed from a user's communication network; and 

when the detection of the unauthorized access is notified, performs the 
following process: 

a search process of searching the flowing-in path of the unauthorized access 
to the services disclosed from the user's communication network; 

a determination process of determining a countermeasure implementation 
plarming fe e-place to impl e m e nt a count e rm e asur e for protecting the services from the 
unauthorized access based on a result of the search; and 

a notification process forjudging whether , wh e n it is d e t e rmin e d that th e 
count e rm e asure is implemented in a flow source adjacent to the user's communication 
network is notified of the determination, when it is determined that the flow source is the 
countermeasure implementation plarming place for a reason t hat mdses-the unauthorized 
access flew ^was flowed into the user's communication network, th e d e t e rmination i s 
notifi e d to the flow source, wherein 

the notification process notifies the flow source of the determination of the 
countermeasure implementation planning place, when it is judged that the flow source is 
notified of the determination, and 

by having the program executed by the computer; 
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thean unauthorized access countermeasure implementation control process 
that has the countermeasure for protecting the services from the unauthorized access 
implemented in the flow source when it is judged that the determination will not be 
notified to the flow source based on the above notification process is further performed by 
the computer. 

14. (Previously Presented) The recording medium according to 
claim 13, wherein the judgement is made based on judgement information on the flow 
source that is given in advance. 

1 5. (Original) The recording medium according to claim 2, wherein 
by having the program executed by the computer; 

the unauthorized access countermeasure implementation control process 
that has the countermeasure for protecting the services from the unauthorized access 
implemented in the user's communication network based on the determination that said 
countermeasure is implemented in the user's communication network is performed by the 
computer. 

1 6 . (Original) The recording medium according to claim 1 5 , wherein 
the process of implementing the countermeasure in the POP (point of presence) edge 
router to which the flow source of the unauthorized access is connected is performed by 
the computer. 
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17. (Previously Presented) The recording medium according to 
claim 16, wherein the process of identifying the POP edge router to which the transmitter 
is connected based on the information obtained from the operation management system 
that manages the operation of the user's communication network is further performed by 
the computer. 

1 8. (Original) The recording medium according to claim 1 5, wherein 
by having the program executed by the computer; 

the process of obtaining a notification of the determination that 
unauthorized access to the services disclosed from a communication network different 
from the user's communication network is made to flow into said other communication 
network is further performed by the computer; and 

the process of implementing the countermeasure for protecting the services 
disclosed from said other communication network from the unauthorized access related to 
the notification in the user's communication network when the notification is obtained by 
the notification obtaining process is performed by the computer. 

1 9. (Original) The recording medium according to claim 1 5, wherein 

the countermeasure implemented by the unauthorized access countermeasure 
implementation control process is cancelled after the unauthorized access is not detected 
any more and a preset time passes. 
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20. (Previously Presented) The recording medium according to 
claim 19, wherein the preset time is set based on the security policy on the network 
operation of both the user's communication network and the other communication 
network. 

21. (Original) The recording medium according to claim 20, wherein 
when the times set between the user's communication network and the other 
communication network based on the security policy on the network operation of both 
networks differ between both networks, the countermeasure is cancelled after the 
imauthorized access is not detected any more and a shorter time of the two passes. 

22. (Original) The recording medium according to claim 2, wherein 
by having the program executed by the computer; 

the process of obtaining a notification of the determination that 
unauthorized access to the services disclosed from a communication network different 
from the user's communication network is made to flow into said other communication 
network is performed by the computer; 

the process of searching the flowing-in path of the unauthorized access 
related to the notification in the user's commimication network when the notification is 
obtained by the notification obtaining process is performed by the computer; 

the process of determining the place to implement the countermeasure for 
protecting the services disclosed from said other communication network from the 
imauthorized access related to the notification based on the result of the search when the 
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notification is obtained by the notification obtaining process is performed by the 
computer; and 

the process of notifying, according to a determination that the 
countermeasure is implemented in the flow source that makes the unauthorized access 
related to the notification flow into the user's communication network when the 
notification is obtained by the notification obtaining process, the determination to the flow 
source is performed by the computer. 

23. (Original) The recording medium according to claim 22, wherein 
by having the program executed by the computer; 

the unauthorized access countermeasure implementation control process 
that has the countermeasure for protecting the services disclosed from the user's 
communication network or the other communication network from the unauthorized 
access related to the notification implemented in the communication network of the 
notification source of the notification when the notification obtained by said notification 
obtaining process is the same as that obtained in the past is further performed by the 
computer. 

24. (Original) The recording medium according to claim 23, wherein 
the process of notifying the information that uniquely identifies the unauthorized access 
related to the notification when the determination is notified is performed by the 
computer. 
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25. (Original) The recording medixam according to claim 2, wherein 
by having the program executed by the computer; 

the process of recording the history of the notification is further performed 
by the computer. 

26. (Currently Amended) An unauthorized access prevention 
method, including: 

searching the flowing-in path of unauthorized access transmitted from a 
transmitter to the services disclosed from the user's communication network; 

determining a countermeasure implementation planning place to implem e nt 
a count e rm e asuro for protecting the services from the unauthorized access based on a 
result of the search; and 

notifying , according to a d e t e rmination that th e count e rm e asuro is 
impl e m e nt e d in a flow sourc e that mak e s th e unauthoriz e d acc e ss flow into th e us e r's 
communication n e twork, th e d e t e rmination of th e plac e to implomont th e count e rm e asur e 
of th e plac e to impl e m e nt th e count e rm e asur e to th e flow source adjacent to the user's 
communication network of the determination of the countermeasure implementation 
planning place, when the determination unit determines the flow source as the 
countermeasure implementation planning place for a reason that the unauthorized access 
was flowed into the user's communication network . 

27. (Cancelled) 
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